Do Son CYFIRMA exposes APT-36 weaponizing a fake NCERT WhatsApp advisory to deliver a stealthy backdoor and seize long-term control of government systems.
social engineering
Kaspersky warns of Webrat malware targeting researchers via fake GitHub PoCs for CVE-2025-10294 and other high-CVSS flaws to install a backdoor.
SEQRITE Labs uncovers a China-linked campaign targeting Indian firms with fake tax notices to install persistent Remote Access Trojans.
Fortra unmasks Scripted Sparrow, a global BEC collective sending 3M+ targeted emails monthly via spoofed executive chains to steal millions.
A sophisticated new phishing campaign is targeting employees where they are most vulnerable—their paychecks—by leveraging QR codes...
Proofpoint warns of a surge in device code phishing where attackers abuse Microsoft 365 OAuth flows to hijack accounts and bypass MFA.
Sophos CTU reveals how the ClickFix tactic led to a Qilin ransomware attack via NetSupport RAT and StealC V2 using stolen VPN credentials.
Gen Digital uncovers AuraStealer, a new infostealer using TikTok "Scam-Yourself" tactics to trick users into infecting their own Windows PCs.
The Forum Troll APT is targeting Russian scholars with highly personalized phishing lures and the Tuoni framework disguised as plagiarism reports.
A Russian APT is targeting Transnistria and NATO entities using blurred HTML attachments to harvest credentials. The 2025 campaign mimics official presidential decrees.
Operation MoneyMount-ISO targets Russian financial institutions with a Phantom Stealer info-stealer hidden in an ISO file. The malware steals crypto wallets, browser data, and uses a keylogger. It has a SelfDestruct function for evasion.
Volexity exposed Russian APT UTA0355 using fake security conference sites and WhatsApp support to trick victims. The attacks steal Microsoft 365 OAuth and Device Code tokens for persistent access.
Google expanded Android's call-scam protection. It detects suspicious calls while financial apps are open, triggering a 30-second mandatory pause for users.
Sekoia exposed Russian Calisto APT (FSB-linked) targeting RSF and NGOs with spear-phishing. The attack uses a custom AiTM kit and a "missing file" lure to steal credentials and 2FA codes.
E-commerce giant Coupang confirmed a breach exposing 33.7 million users (names, emails, addresses)—nearly its entire base. Financial data was not compromised, but social engineering risk is high.
Darktrace exposed TAG-150, a new MaaS operator compromising 469+ US devices in months. The group uses ClickFix to trick victims into running malicious PowerShell that deploys the CastleLoader/CastleRAT backdoor.
Bitsight TRACE exposes a massive calendar phishing network targeting 4M+ devices. Learn how "Promptware" exploits AI assistants via malicious calendar events.
A new macOS threat uses malicious AppleScript (.scpt) files, disguised as documents/updates, to bypass Gatekeeper and execute stealers like MacSync and Odyssey, exploiting user trust.
North Korea's KONNI APT is exploiting stolen Google accounts and the Find Hub service to remotely wipe South Korean Android devices for data destruction and surveillance, then spreading malware via KakaoTalk.
Proofpoint exposed UNK_SmudgedSerpent, an APT using RMM tools (PDQConnect) and M365 spoofs in targeted phishing campaigns against academics and foreign policy experts with complex Iranian political lures.
Check Point exposed four critical flaws in Microsoft Teams. Attackers could forge executive caller IDs, silently edit messages without trace, and spoof notifications for BEC and espionage.
Lab52 exposed Lazarus Group using DreamLoader malware via fake job lures. The modular tool chain abuses DLL sideloading and the Microsoft Graph API for stealthy C2 communications.